DOMPurify versions prior to 2.5.0 and versions from 3.0.0 up to but not including 3.1.3 are vulnerable to a nesting-based mutation cross-site scripting (mXSS) vulnerability (CVE-2024-47875). This vulnerability allows an attacker to inject malicious scripts by exploiting nested HTML structures. The issue has been fixed in versions 2.5.0 and 3.1.3. The vulnerability has a critical severity with a CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability if exploited.